Hybrid Azure Active Directory joined

This article describes the requirements to create Hybrid Azure Active Directory (HAAD) joined catalogs using Citrix DaaS in addition to the requirements outlined in the Citrix DaaS system requirements section.

Hybrid Azure AD joined machines use on-premises AD as the authentication provider. You can assign them to domain users or groups in on-premises AD. To enable Azure AD seamless SSO experience, you need to have the domain users synced to Azure AD.

Note:

Hybrid Azure AD joined VMs are supported in both federated and managed identity infrastructures.

Requirements

• Control plane: See Supported Configurations
• VDA type: Single-session (desktops only) or multi-session (apps and desktops)
• VDA version: 2112 or later
• Provisioning type: Machine Creation Services (MCS), Persistent and Non-persistent
• Assignment type: Dedicated and pooled
• Hosting platform: Any hypervisor or cloud service
• Master VMs must not be joined to Azure AD

Limitations

• If Citrix Federated Authentication Service (FAS) is used, single sign-on is directed to on-premises AD rather than Azure AD. In this case, it is recommended to configure Azure AD certificate-based authentication so that the primary refresh token (PRT) is generated upon user logon, which facilitates single sign-on to Azure AD resources within the session. Otherwise, the PRT will not be present and SSO to Azure AD resources will not work.

Considerations

• Master VMs can be on-premises AD joined or non-domain-joined.
• Creating hybrid Azure Active Directory joined machines requires the Write userCertificate permission in the target domain. Make sure that you enter credentials of an administrator with that permission during catalog creation.

• The hybrid Azure AD joining process is managed by Citrix. You need to disable autoWorkplaceJoin controlled by Windows in the master VMs as follows:

  1. Run gpedit.msc.
  2. Navigate to Computer Configuration > Administrative Templates > Windows Components > Device Registration.
  3. Set Register domain joined computers as devices to Disabled.
• Select the Organizational Unit (OU) that is configured to be synced with Azure AD when you create the machine identities.

Where to go next

For more information on creating Hybrid Azure Active Directory joined catalogs, see Create Hybrid Azure Active Directory joined catalogs.